56 articles · Cross-sector · page 3 of 3
Articles
Week of 3 January 2022
After the FTC’s Log4j warning, the response record was the defense
In January 2022 the FTC told companies that leaving Log4j unfixed could break the law. Regulators judge “reasonable” security after the fact, from records, so the work that counted most was writing down the response as it happened.
Week of 6 December 2021
Log4Shell was a search problem before it was a patching problem
The Log4j flaw of December 2021 was easy to exploit and easy to fix. The real crisis was finding it, and that hunt looked very different for software an organization builds, software it buys and software it rents as a service.
Week of 18 October 2021
BlackMatter’s reach was set by the directory, not the malware
The October 2021 BlackMatter advisory described an unglamorous attack: intruders walked in with stolen passwords and simply asked the company directory where everything was. How far one login could travel had been decided years earlier, by how access was designed.
Week of 6 September 2021
Vaccination status was the easy record; exemptions were the hard one
President Biden’s September 2021 vaccination plan sent employers scrambling to collect proof. It demanded three things: status records, weekly testing and exemption decisions. The third carried the lasting legal risk, and most organizations built it last and least.
Week of 16 August 2021
Data stayed in China and still left: PIPL’s remote access problem
China’s Personal Information Protection Law, adopted in August 2021, pushed multinationals to keep data inside China. Storing it there was the easy half. Personal information still left through three routes no data center map shows: copies, remote views and the reports built from it.
Week of 28 June 2021
Kaseya and the most privileged system nobody on site runs
REvil’s attack through Kaseya VSA reached hundreds of businesses through the very tools their IT providers used to look after them. The clients had outsourced the work but kept the risk, and three gaps decided their exposure: privilege, concentration and contract.
Week of 19 April 2021
How the AI Act proposal tied risk to the use, whatever the model
The European Commission’s April 2021 AI Act proposal regulated what AI is used for, not how it is built. Its four tiers sorted the AI in banks, hospitals and agencies by business process, so compliance belonged to process owners as much as to data scientists.
Week of 15 February 2021
Why working from home failed when Texas froze
A year into the pandemic, many continuity plans answered every site outage with “work from home.” Winter Storm Uri took out power, water, roads and home internet together, showing that one fallback fails when people, sites, networks and suppliers all fail at once.
Week of 2 November 2020
Exempt institution, covered data: what Proposition 24 meant for banks and hospitals
Proposition 24 created the first U.S. regulator devoted to privacy. Banks and health systems that assumed federal law exempted them learned that California exempts certain data, not whole institutions, and that everything else needs real operational plumbing.
Week of 19 October 2020
Antitrust moves in years; vendor dependency is set at signing
The Justice Department’s case against Google opened a long fight over platform power. It offered regulated buyers no relief on their own dependence on vendors, which is settled in contracts, system design and tested exit plans, far faster than any court moves.
Week of 12 October 2020
Why one phone call beat Twitter’s login controls
No clever code, no exotic exploit. New York’s report on the Twitter hack traced it to a phone call and a fake login page. The people who verify callers and reset logins turned out to be a security control few had designed or measured.
Week of 28 September 2020
From crisis call to compliance record: OFAC’s ransomware advisory
Treasury’s October 1, 2020 advisories did not ban ransom payments. They attached strict sanctions liability to victims and to the firms that help them pay, which moved the decision out of the crisis room and into a governed, documented compliance process.
Week of 20 July 2020
The control system map most operators did not have
On July 23, 2020, the NSA and CISA urged immediate action to protect the systems that run pumps, chillers and power. Their first and hardest request was an accurate map of what was actually connected, something few utilities, hospitals or data center operators had.
Week of 13 July 2020
Schrems II and the case for deciding where data lives first
On July 16, 2020, Europe’s highest court struck down Privacy Shield and made the remaining contracts depend on case-by-case checks. Organizations that first decided where their data lived, and who held the keys, found the paperwork easier and rode out later swings in the law.
Week of 20 April 2020
Zoom 5.0 fixed the vendor layer; configuration and records stayed yours
Zoom 5.0, released in April 2020, fixed real problems in its own product. For banks, hospitals and agencies, the bigger risks lived in two places no vendor could fix for them: how the tool was set up, and what its meetings left behind.
Week of 24 February 2020
Buildings intact, workforce gone: the scenario continuity plans skipped
As markets fell and federal health officials warned of community spread, most continuity plans still imagined losing a building. A pandemic takes away people, suppliers and the usual tools all at once, and plans had to be rebuilt and tested around those three losses.